For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Raj_Siva_327012's avatar
Raj_Siva_327012
Icon for Nimbostratus rankNimbostratus
Jul 12, 2017

SNAT - same VLAN ?

Do we need SNATs if the server is in the same VLAN as the self / floating IPs ? the default gateway of the server is not the F5 in this case...   for ex   external VIP - 172.18.2.153   pool ...
application delivery
LTM
security
Munney_64889's avatar
Munney_64889
Icon for Nimbostratus rankNimbostratus
Jul 12, 2017

If you don't SNAT, the source address of the requesting client will get passed straight on through to the server. And then the server will see the client as a non-local IP address and use it's default gateway to respond to, bypassing the load balancer.

 

Asynchronous route. Game over.

 

Raj_Siva_327012's avatar
Raj_Siva_327012
Icon for Nimbostratus rankNimbostratus
Jul 13, 2017

THanks for the answers guys.. In this case, the Real server and the F5 are in the same VLAN. as per IP forwarding, the source mac of the packet will be F5's self IP, and the packets are going to come back to F5.. Right ? SNAT will be used, only if the real server is in a different VLAN than the F5 inside IP.. Am I right ?